Linux kernel libceph: unbounded pg_temp length lets a malicious monitor cause a stack out-of-bounds write

Impact

__decode_pg_temp() accepted any OSD-set length that did not overflow the allocation, but apply_upmap() and get_temp_osds() later copy that list into a fixed 32-entry array on the kernel stack. A monitor that hands the client an OSDMap with a pg_temp or pg_upmap entry longer than 32 gets a stack out-of-bounds write in the host kernel, with the reporter's KASAN trace landing in ceph_pg_to_up_acting_osds() on the normal rbd map path. This is a write, not a read, so the ceiling is host kernel compromise on every node that consumes the poisoned map - and every node in the cluster consumes the same map, so a single bad monitor reply fans out across the fleet rather than hitting one node. On a GPU fleet that is a simultaneous loss of nodes that are expensive to drain and re-schedule.

Who can reach it

An attacker controlling or impersonating a Ceph monitor that the node's kernel client fetches OSDMaps from. No authentication to the node and no local access are needed; a tenant pod using an already-mapped volume cannot reach the decoder.

What to do

Take a stable kernel containing the CEPH_PG_MAX_SIZE bound in __decode_pg_temp() and __decode_pg_upmap_items(); the record lists commits only, so get the shipped version from your distribution advisory. Kernel fix, so drain and reboot each node, or apply a vendor livepatch if one exists. Interim mitigation is the same as for any hostile-monitor bug: keep the mon network off tenant-reachable paths and enforce cephx authentication.

References

Related entries

• CephFS kernel client (ceph.ko, ceph_handle_caps): The kernel trusts snap_trace_len straight off the wire, so aCVE-2026-68160 · CephFS kernel client (ceph.ko, ceph_handle_caps)Critical
• Linux kernel (net/xfrm): When IPsec crypto offload takes a GSO segment asynchronously, the segment is unlinked from theCVE-2026-68426 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): The ESP-in-TCP send path mis-tracked scatter-gather message offsets and socket memory chargesCVE-2026-72041 · Linux kernel (net/xfrm)Critical
• Linux kernel LIO target: unbounded iSCSI TransportID parse in PR OUT reads past the parameter bufferCVE-2026-72084 · Linux kernel LIO SCSI target (PERSISTENT RESERVE OUT TransportID parsing, iSCSI FORMAT CODE 01b)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: The sibling of theCVE-2026-72130 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel (net/xfrm): NAT-keepalive frees the keepalive skb whenever the IPv4/IPv6 send helper returns an errorCVE-2026-72137 · Linux kernel (net/xfrm)Critical